NISM-IFSCA-02A and 02B: Cyber Security and Cyber Resilience Certification in GIFT IFSC

The International Financial Services Centres Authority (IFSCA), in collaboration with the National Institute of Securities Markets (NISM), has introduced two new certification courses focused on Cyber Security and Cyber Resilience in the GIFT IFSC.

These certifications aim to strengthen cyber security awareness, risk management, governance and resilience across regulated entities operating in India's International Financial Services Centres (IFSCs).

The two certifications are:

1. NISM-IFSCA-02A: Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)

2. NISM-IFSCA-02B: Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)

IFSCA has also issued a circular dated October 27, 2026, specifying which employees of regulated entities must obtain these certifications.

If you are preparing for either examination, this guide explains the certification requirements, examination structure, important topics and how to prepare using mock tests.

1. Why Has IFSCA Introduced These Certifications?

Financial institutions increasingly depend on digital infrastructure, online platforms, cloud services, data systems and interconnected technology environments.

This creates cyber security risks such as:

• Phishing and social engineering attacks

• Ransomware and malware

• Data breaches and information theft

• Unauthorised access to critical systems

• Third-party and vendor-related cyber risks

• Application and network vulnerabilities

• Cyber incidents affecting business continuity

For financial institutions operating in GIFT IFSC, effective cyber security is not only an IT responsibility. It is also an important part of organisational governance, regulatory compliance and risk management.

IFSCA's cyber security guidelines require regulated entities to strengthen the cyber security knowledge of their governing boards, senior management and employees.

To establish a common knowledge benchmark across the IFSC ecosystem, NISM and IFSCA have developed the Basic and Advanced Cyber Security and Cyber Resilience certifications.

2. What Is NISM-IFSCA-02A: Basic Cyber Security Certification?

The NISM-IFSCA-02A certification is designed to establish foundational knowledge of cyber security and cyber resilience for individuals working in the IFSC ecosystem.

It is intended for IFSCA officers, employees of regulated entities and other individuals interested in understanding cyber security practices applicable to GIFT IFSC.

The examination goes live on November 18, 2026.

Key objectives of NISM-IFSCA-02A

Candidates preparing for this examination should develop an understanding of:

• Fundamentals of cyber security and cyber resilience

• Cyber threats, threat actors and threat modelling

• Cyber security governance and risk management

• Security architecture and defence-in-depth

• Asset management and access management

• Third-party risk management

• Application and data security

• Vulnerability management

• Security awareness and cyber hygiene

• Cyber incident detection, response and recovery

• IFSCA cyber security regulatory requirements

• Emerging challenges involving artificial intelligence and quantum computing

NISM-IFSCA-02A examination pattern

Examination fee is subject to applicable payment gateway charges.

Who should take the Basic certification?

This certification is particularly relevant for:

• Designated Officers of regulated entities

• Compliance Officers

• Employees responsible for IT operations

• Employees responsible for information security

• Employees having privileged access to critical systems

• Other employees of regulated entities

• Individuals interested in cyber security and financial-sector regulation

3. What Is NISM-IFSCA-02B: Advanced Cyber Security Certification?

The NISM-IFSCA-02B certification is the advanced-level certification designed to develop deeper knowledge of cyber security governance, risk management, regulatory expectations and organisational cyber resilience.

It is intended particularly for key function holders and professionals responsible for cyber security oversight and management within regulated entities.

The examination goes live on December 30, 2026.

Key objectives of NISM-IFSCA-02B

Candidates are expected to develop the ability to:

• Analyse cyber security risks and evolving cyber threats

• Evaluate cyber security governance and risk management frameworks

• Apply security principles across critical technology domains

• Assess third-party and supply-chain security risks

• Evaluate application, network and data security controls

• Understand vulnerability assessment and penetration testing

• Assess incident response and recovery arrangements

• Interpret IFSCA regulatory requirements

• Analyse cyber security implications of AI and quantum computing

• Apply cyber security concepts through case studies and practical scenarios

The Advanced certification goes beyond foundational awareness by emphasising analysis, application, assessment and case-based understanding.

NISM-IFSCA-02B examination pattern[1]

The case-based section contains two cases with four questions of two marks each and one case with four questions of one mark each.

4. Difference Between NISM-IFSCA-02A and NISM-IFSCA-02B

Although both certifications cover cyber security and cyber resilience in GIFT IFSC, their intended depth and assessment structures differ.

Which one should you choose?

• Choose 02A Basic if you need foundational cyber security knowledge or your role requires the Basic certification.

• Choose 02B Advanced if you are responsible for cyber security oversight, governance, risk management or related senior responsibilities, or want to develop advanced knowledge.

Check the applicable IFSCA requirements for your role before selecting an examination.

5. Who Must Obtain These Certifications Under the IFSCA Circular?

One of the most important developments is the IFSCA circular dated October 27, 2026, titled:

Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs.

The circular specifies mandatory and encouraged certification requirements.

Certification requirements by employee role

What is the certification deadline?

The employees for whom certification is mandatory must obtain the respective certification within:

Six months from the date the relevant examination goes live, or six months from their appointment to the relevant role, whichever is later.

The applicable individuals must continue to hold a valid certification while discharging responsibilities in that role.

Regulated entities must also maintain certification records and make them available to IFSCA when requested.

These requirements are based on IFSCA's October 27, 2026 circular. Organisations and employees should refer to the official circular for the complete applicability and conditions.

6. Important Topics Covered in the NISM-IFSCA Cyber Security Examinations

Both certifications cover important cyber security and cyber resilience concepts. The Advanced certification also includes greater emphasis on practical application and case studies.

Some of the important areas are:

A. Fundamentals of Cyber Security

• Cyber security principles

• Confidentiality, Integrity and Availability (CIA)

• Cyber security threats and vulnerabilities

• Threat modelling

• Security frameworks such as NIST CSF and ISO/IEC 27001

• Defence-in-depth and layered security

B. Cyber Security Governance and Risk Management

• Cyber security governance structures

• Roles and responsibilities

• Cyber risk management lifecycle

• Security policies and procedures

• Risk assessments and audits

• Control effectiveness and reporting

C. Security Architecture and Access Management

• Network security architecture

• Cloud security

• Zero Trust security model

• Authentication and authorisation

• Role-Based Access Control (RBAC)

• Multi-Factor Authentication (MFA)

• Privileged Access Management

D. Asset and Third-Party Risk Management

• Asset identification and classification

• Asset inventory and ownership

• Vulnerability management

• Vendor risk assessment

• Third-party security controls

• Software supply-chain risks

• Contractual security safeguards

E. Application and Data Security

• Secure Software Development Lifecycle (SDLC)

• OWASP Top 10

• Secure coding practices

• API and microservices security

• Data encryption

• Data classification

• Data Loss Prevention (DLP)

• Data backup and recovery

• Personal data protection

F. Vulnerability Management and Cyber Hygiene

• Vulnerability scanning

• Patch management

• Configuration hardening

• Penetration testing

• Social engineering awareness

• Phishing prevention

• Employee security training

G. Incident Response and Cyber Resilience

• Security incident detection

• Incident response lifecycle

• Security Operations Centre (SOC)

• SIEM, XDR and SOAR

• Threat intelligence

• Business continuity planning

• Disaster recovery

• Recovery objectives

• Digital forensics and evidence handling

H. IFSCA Regulatory Framework

• IFSCA cyber security and cyber resilience guidelines

• Governance requirements for regulated entities

• Risk assessment and access control

• Incident reporting and audit requirements

• Third-party risk obligations

• Additional requirements for Market Infrastructure Institutions

I. Emerging Cyber Security Challenges

• AI-enabled cyberattacks

• Deepfake-related fraud

• Quantum computing risks

• IoT and 5G security

• Cyber warfare and geopolitical risks

• AI governance challenges

7. Why Practise with NISM-IFSCA-02A and 02B Mock Tests?

Understanding the study material is important, but attempting practice questions can help candidates evaluate their preparation.

Mock tests can help you:

1. Understand the examination format: Become familiar with the question styles and assessment structure.

2. Revise important concepts: Practise questions covering cyber security, governance, risk management and resilience.

3. Identify knowledge gaps: Discover topics that require additional study.

4. Improve time management: Practise answering questions within the examination time.

5. Prepare for case-based questions: For the Advanced examination, develop the habit of analysing scenarios and applying concepts.

Practise NISM-IFSCA-02A Basic Mock Test

Prepare for the Basic Cyber Security and Cyber Resilience certification with practice questions covering the published examination objectives.

PassNISM Mock Test: NISM-IFSCA-02A – Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)

Practise NISM-IFSCA-02B Advanced Mock Test

Prepare for the Advanced Cyber Security and Cyber Resilience certification with practice questions covering advanced concepts, regulatory requirements and scenario-based learning.

PassNISM Mock Test: NISM-IFSCA-02B – Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)

8. How to Prepare for the NISM-IFSCA Cyber Security Certification?

Here is a practical preparation approach for candidates.

Step 1: Identify your applicable certification

Check whether your role requires the Basic certification, the Advanced certification or both.

Step 2: Download the official NISM study material

Use the official NISM course material and examination objectives as your primary study resources.

Step 3: Study the fundamentals

Start with cyber security principles, threats, vulnerabilities, governance and risk management.

Step 4: Understand the IFSCA guidelines

Pay particular attention to regulatory requirements applicable to regulated entities and Market Infrastructure Institutions.

Step 5: Practise mock tests

Attempt practice questions after completing each major topic. Review incorrect answers and revisit the corresponding study material.

Step 6: Attempt a timed practice examination

For Basic, practise completing 50 questions in 60 minutes. For Advanced, practise managing the 80 MCQs and case-based questions within 120 minutes.

For the Advanced examination, remember that negative marking applies. Avoid treating every question as an automatic attempt.

9. Frequently Asked Questions (FAQs)

What is NISM-IFSCA-02A?

NISM-IFSCA-02A is the Basic Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC, developed by NISM in collaboration with IFSCA. Its examination goes live on November 18, 2026.

What is NISM-IFSCA-02B?

NISM-IFSCA-02B is the Advanced Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC. Its examination goes live on December 30, 2026.

Is NISM-IFSCA-02A mandatory?

It is mandatory for Designated Officers, the specified CISO of Market Infrastructure Institutions, Compliance Officers, and employees responsible for IT operations or information security or having privileged access to critical systems of regulated entities. Other employees are encouraged to obtain it.

Is NISM-IFSCA-02B mandatory?

The IFSCA circular makes the Advanced certification mandatory for Designated Officers and the specified CISO of Market Infrastructure Institutions. For Compliance Officers and specified IT and information security employees, it is encouraged.

What is the passing percentage for NISM-IFSCA-02A?

The passing percentage for the Basic certification is 50%, or 25 marks out of 50. There is no negative marking.

What is the passing percentage for NISM-IFSCA-02B?

The passing percentage for the Advanced certification is 60%, or 60 marks out of 100. Negative marking of 25% of the marks assigned to a question applies.

What is the validity of the certifications?

The Basic 02A certificate is valid for two years, while the Advanced 02B certificate is valid for three years, according to the published NISM examination details.

Can individuals outside GIFT IFSC take these examinations?

Yes. NISM's published examination information provides an opportunity for individuals outside regulated entities who are interested in enhancing their cyber security and cyber resilience knowledge to take the Basic examination. The Advanced examination is also open to other individuals as defined by the applicable IFSCA requirements.

Where can I find the official study material?

Candidates can access the respective course information, examination objectives and study material through the official NISM website.

Conclusion

The introduction of NISM-IFSCA-02A and NISM-IFSCA-02B represents an important step towards strengthening cyber security and cyber resilience across the GIFT IFSC financial ecosystem.

The Basic certification focuses on foundational awareness and knowledge, while the Advanced certification develops deeper understanding of governance, risk management, regulatory expectations and practical cyber security scenarios.

For professionals working with IFSC-regulated entities, understanding which certification applies to their role is especially important following the IFSCA circular dated October 27, 2026.

Prepare with the official NISM study material, understand the applicable regulatory requirements and practise regularly to assess your readiness.

Start preparing for the new NISM-IFSCA Cyber Security certifications with PassNISM mock tests.